Meta:Requests for CheckUser information/Archives/2019

Please do not post any new comments on this page. This is a discussion archive first created on 01 January 2019, although the comments contained were likely posted before and after this date. See current discussion or the archives index.

Looks like cross wiki spam accounts, all interested in one single person, but most of them don't have contributions in the same project, and that is why I requested a check user in this page. Some of them however do, and have taken part at the same discussion, like Kyriaki Verrou and Lucky Billy 1999 in simple.wikipedia and 4evayoung77 and Hamogela, violating the sock puppet rules if they are. C messier (talk) 16:10, 28 February 2019 (UTC)

It looks like you're looking for Steward requests/Checkuser instead? None of the accounts listed have any edits here at Meta, thus a local check would not return any results. Please also note that simplewiki has local checkusers and that there's no global checkuser feature. If you want the accounts to be checked on some projects, please also state which ones because stewards will have to do them on each wiki if they accept the request. Regards, —MarcoAurelio (talk) 19:22, 28 February 2019 (UTC)

Both these accounts are probably socks of Skiyomi based on the behavior: inserting gibberish characters - 1, see deleted contributions of Challenge812 and Acquiescence88, creating pages with no meaningful content such as "Hello" or other meaningless strings. The two accounts also both (as well as other socks) involve cross-wiki abuse with the behavior same as meta, so a global lock should be justifiable (regardless of whether they are the same individual or not). -★-PlyrStar93→Message me. ← 15:30, 7 April 2019 (UTC)

Abuser is blatantly attacking this user. If we could please identify the range, and either 1) block the hell out of it here completely for a while; or 2) look to block that range on the user talk: page of the person, or from the whole user talk: ns. Thanks. — billinghurstsDrewth 08:02, 21 June 2019 (UTC)

@Billinghurst: They're all technically related & have many more out there. A range block might be possible but I need to take a deeper look to avoid blocking too many inocent people. —MarcoAurelio (talk) 20:05, 22 June 2019 (UTC)

@MarcoAurelio: I was hoping that you could do a partial block on the IP range and depending on the level of infestation it could be user talk: ns or solely that target page. — billinghurstsDrewth 23:12, 22 June 2019 (UTC)

I have semiprotected the DB's talk page for two years and locked the remaining sleepers. —MarcoAurelio (talk) 10:12, 23 June 2019 (UTC)

Other measures have been put in place as well. —MarcoAurelio (talk) 18:44, 25 June 2019 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 18:44, 25 June 2019 (UTC)

Reason(s): I think both are the same person and joined the same discussion, per this and this edits. Both of them were forgot to add signature and added after the same style. Please check this users. Thanks in advance --eldarado ✉ 08:38, 29 May 2019 (UTC)

This is a somewhat unusual request as it concerns a Checkuser decision on the English Wikipedia that has been contested here on Meta through the use of the listed IP address and the main account. Last month the Rivselis account was blocked on the English wikipedia as a suspected sockpuppet of Neotarf citing a "likely" result from Checkuser evidence. A week or so after that block occurred, Neotarf posted to the Rivselis talk page here on Meta to contest the action using the above IP address. Neotarf subsequently pointed to that IP address as proof the accounts were unrelated and badgered the blocking admin from English Wikipedia on his talk page here.

Looking into it, the IP address used shows signs of being an open proxy having been used on multiple Wikimedia projects in different languages, including Chinese, and has clearly been used by multiple users with different geographic profiles. One site identified the IP as a likely proxy. A "likely" finding may mean the accounts are unrelated and the IP is not definitively identified as a proxy server as some services suggest it might be a normal IP address. However, if Neotarf and Rivselis are the same person and the IP address is an open proxy then mutliple policies have been violated. Specifically, the use of an open proxy in this way would violate the policy on open proxies and if Neotarf is knowingly badgering a user with false allegations then that would violate the urbanity policy. However, whether a violation has occurred can't be reasonably determined without checking the above accounts and the IP address.--The Devil's Advocate (talk) 21:30, 28 July 2019 (UTC)

The Devil's Advocate: the en.wiki block was made taking into account the CU data from meta, because Neotarf is stale on en.wiki. That is to say, checking again on meta wiki would not yield any new information that was not already discussed between myself and a meta CU when the block was made. TonyBallioni (talk) 21:57, 28 July 2019 (UTC)

I am not familiar with CU, so I don't know if Neotarf being active a week after Rivselis might yield a more definitive result. For instance, if the IP identified by Neotarf is a valid one and used by Neotarf, but not Rivselis, that would be new information.--The Devil's Advocate (talk) 22:01, 28 July 2019 (UTC)

If what you’re asking for is what likely means it’s this: both accounts were using the same relatively stable IP in the same time frame on an ISP where sharing an IP close to someone else usually indicates a connection between accounts. There was a difference in UA, which is why this is likely and not confirmed, but because of the other technical details, multiple CUs agree that the UA doesn’t tell us much. The conclusion I reached in consultation with another CU from a different project upon reviewing the data was that it was likely the same person.

There also is behavioural similarity both pre and post-block, that make me believe this is very likely to be the same person. At the same time, CU is not a perfect tool, and the en.wiki ArbCom is able to review additional information that may be submitted in an appeal that CUs don’t have access to. I’ll shut up now and let meta CUs decide how to action your request, but it read as much a request for an explanation of my findings as it did a meta check, which is why I commented :) TonyBallioni (talk) 22:40, 28 July 2019 (UTC)

This is helpful, but I still think comment from Meta CUs is useful because the subsequent actions with the IP address above and the Neotarf account becoming active again occurred after the check. Possible there is new data to review that may confirm of refute the identification. It may change nothing. Either way, there is subsequent behavior here on Meta that would make renewed scrutiny desirable.--The Devil's Advocate (talk) 00:48, 29 July 2019 (UTC)

What subsequent behavior? Neither Neotarf or the IP have edited in over a month. The other account has no edits here, and considering it was registered 4 years ago there is probably no checkuser data available on it. Further, CU's cannot publicly link an IP or account. I don't see what caused this request or what, if any, legitimate reason there is for a metawiki checkuser to check Neotarf. Regards, Vermont (talk) 01:25, 29 July 2019 (UTC)

The request is based on what happened a month ago, but that behavior did come after the last check. No doubt there can be Checkuser information obtained on Rivselis from English Wikipedia. As far as the IP, Neotarf has claimed to be using that IP already. I am only asking to verify if it is a regular IP or a proxy, which a Checkuser may be better able to determine. Pretty sure I explained the legitimate reason for the check in my initial statement.--The Devil's Advocate (talk) 14:40, 29 July 2019 (UTC)

I'm not sure why you think a CheckUser would be better able to discern whether the IP is a proxy. If that is the only point of this, I can tell you with a high degree of certainty that the listed IP is a proxy. Vermont (talk) 15:35, 29 July 2019 (UTC)

That is not the only point, but I imagine a Checkuser can better discern it if they can see other details about who is using an IP address. If you are only going to comment here to try and inexplicably pick at this for some kind of weakpoint, then it is better you stop and let a Checkuser handle the request. As I said, there is data on English Wikipedia and it is more recent than the data from the last check with Neotarf also being active here since then and allowing for additional information from that account to check. One way or another, I trust a Checkuser can find if the new activity can reveal any data that better refines the previous result and make a determination as to whether Neotarf's behavior here on Meta warrants any action.--The Devil's Advocate (talk) 17:17, 29 July 2019 (UTC)

I will note that using open proxies is not against any policy or rule. (edit made using an open proxy)Vermont (talk) 22:04, 28 July 2019 (UTC)

Of course, which is why I said "in this way" as opposed to in any way at all. There are legitimate uses of open proxies. Seeking to falsely discredit another user's actions is not one of them.--The Devil's Advocate (talk) 22:20, 28 July 2019 (UTC)

Declined - The block and disruptive use of socks happened on enwiki. If enwiki CheckUsers want to cross-check data then they can always ask. Having looked at the behavioural evidence and technical data, I am satisfied with the "likely" conclusion and don't think that this new open proxy detracts from it. – Ajraddatz (talk) 19:54, 29 July 2019 (UTC)

Not sure this is really addressing my request unless you are saying you re-examined the data following this request. The issue involved conduct here by Neotarf on Meta after the last check. What happened on English Wikipedia is only relevant in that Neotarf's conduct here was related to that block. Would more recent activity by the account not reveal anything new? To clarify on the IP, are you saying that you reviewed it and determined it was a proxy IP?--The Devil's Advocate (talk) 21:01, 29 July 2019 (UTC)

I am saying that further checks would not be useful, and declining as such. – Ajraddatz (talk) 21:59, 29 July 2019 (UTC)

This section was archived on a request by: SCP-2000 (talk) 11:59, 14 October 2019 (UTC)

This user is demonstrating behaviour of LTA. They have posted at user talk:Billinghurst and Stewards' noticeboard, and possibly with IP addresses, it is a bit muddled so difficult to be exact. I am know that these are socks of each other, I am just wishing to be tied back to the LTA and track the underlying data. Thanks. — billinghurstsDrewth 10:57, 8 November 2019 (UTC)

Jackpot. Yes, the three of them are related as well as a bunch of others such as:

86.179.128.0/17

I have placed a medium term soft block on this IP range as it is inhabited by an LTA, and no evidence of good edits in recent times. Can you please run a check and get rid of recent socks that will be in the range. If you think that there is value in hardening or softening the blocked, then I will go with your judgement. Thanks. — billinghurstsDrewth 23:55, 21 December 2019 (UTC)